[johnInarti]

Adds one entry under tools/. Disclosure: I am the publisher.

A CBOM answers what cryptography is in here. This service answers a narrower question next to it: can a third party still trust this CBOM in five years, and prove it existed before a given date. It signs a CycloneDX CBOM with ML-DSA-65 (FIPS 204) and timestamps it against drand, so integrity, authorship, prior existence and non-repudiation verify offline, without trusting the issuer. Relevant because a cryptographic inventory produced for a migration deadline is exactly the kind of artifact someone will want to re-check long after it was filed — and because the signature itself is post-quantum, it does not expire with the algorithms it is inventorying.

Classified conservatively:

• capabilities: [CBOM] only. It consumes and seals CycloneDX CBOMs; it does not emit CDXA, so I did not claim it.
• functions: [SIGNING/NOTARY] only. There is an informational analyze action, but it is not an audit, so no ANALYSIS claim.
• availability: [FREEMIUM] — verification is free at GET /api/cbom; sealing is paid.
• No platform: it is an HTTP service, not a local binary.

Scope limits are stated by the service itself, and I would rather they be on the record here too: it seals the inventory you declare — integrity, authenticity of the claim, prior existence, non-repudiation. It does not audit the inventory for correctness or completeness, and does not certify PQC readiness or compliance with CNSA 2.0 or any regulation. No FIPS 140-3 / CMVP validation of the module.

Validated locally against schemas/tool.schema.json with jsonschema (passes). tools.json left untouched per the README. Happy to adjust the classification if you would file it differently.